4 ms·

MAC randomization partially reduces privacy risk. But there is a separate issue where your phone broadcasts a list of its known SSIDs (so that it can autojoin k

MAC randomization partially reduces privacy risk. But there is a separate issue where your phone broadcasts a list of its known SSIDs (so that it can autojoin known networks and switch between multiple routers on the most recent network - I believe Lockdown mode disables this). So if your home WiFi router has a unique name, your phone is constantly shouting it, asking if this SSID is nearby. The MAC randomization means that it will be a different MAC shouting this SSID every time. But the billboard vendor can see there is someone walking past it each day at 10am looking for a wifi network with SSID "PrettyFlyForAWifi." And they can search that SSID in a public wifi map like Wigle.net to find the location of your house. To mitigate this, find the most common router name in your country and use that for your home network.

01HNNWZ0MV43FF 3y ago
I guess it's `xfinitywifi` https://wigle.net/stats#ssidstats https://wigle.net/stats#ssidstats But....... if I do that, and my neighbors all definitely have it, how does my phone know which one to connect to? Am I leaking my password to my neighbor's APs, or does it use a hash somehow? How do I tell my friends "My Wi-Fi is xfinitywifi... not that one... not that one... uh just put in the BSSID"
- chatmasta 3y ago
  You don't leak your password. There is some kind of hashing involved, but I can't remember the details and don't want to comment with incorrect information. Hopefully someone who knows the answer will reply... :)
- chatmasta 3y ago
  Update: The answer [0] is basically that if the probe request is for an SSID of an open network, then a malicious access point can say "that's me" and the client will connect. (Also, note the "that's me" is not a response per se, but a separate advertisement for a network with that name.) But if it's for a WEP or WPA/2 network, the client won't connect unless the malicious router also knows the password for that network, because the handshake used to generate encryption keys requires that the client and access point agree on a shared secret. A malicious router doesn't know ahead of time whether the SSID in a probe request refers to an open network, so it could try to establish it and see if the client connects. (Even for closed networks, it's also possible there is a bug in some client software that would ignore errors caused by the server supplying the wrong key?) [0] https://security.stackexchange.com/a/210798/76104 https://security.stackexchange.com/a/210798/76104

01HNNWZ0MV43FF 3y ago

I guess it's `xfinitywifi` https://wigle.net/stats#ssidstats https://wigle.net/stats#ssidstats But....... if I do that, and my neighbors all definitely have it, how does my phone know which one to connect to? Am I leaking my password to my neighbor's APs, or does it use a hash somehow? How do I tell my friends "My Wi-Fi is xfinitywifi... not that one... not that one... uh just put in the BSSID"

chatmasta 3y ago
You don't leak your password. There is some kind of hashing involved, but I can't remember the details and don't want to comment with incorrect information. Hopefully someone who knows the answer will reply... :)
chatmasta 3y ago
Update: The answer [0] is basically that if the probe request is for an SSID of an open network, then a malicious access point can say "that's me" and the client will connect. (Also, note the "that's me" is not a response per se, but a separate advertisement for a network with that name.) But if it's for a WEP or WPA/2 network, the client won't connect unless the malicious router also knows the password for that network, because the handshake used to generate encryption keys requires that the client and access point agree on a shared secret. A malicious router doesn't know ahead of time whether the SSID in a probe request refers to an open network, so it could try to establish it and see if the client connects. (Even for closed networks, it's also possible there is a bug in some client software that would ignore errors caused by the server supplying the wrong key?) [0] https://security.stackexchange.com/a/210798/76104 https://security.stackexchange.com/a/210798/76104